create-safest-tools 0.4.0 → 0.4.1

package/README.md

@@ -18,7 +18,7 @@ npx create-safest-tools safest-resolve \
   --email-from reports@example.com
 ```
 
-The `--email-from` address must belong to a domain onboarded under Cloudflare Email Service → Email Sending. Domain onboarding permits delivery to arbitrary invited users; invitations, email verification, and forgot-password delivery use this address.
+The `--email-from` address is used only for reporter receipts, follow-ups, and outcomes, and must belong to a domain onboarded under Cloudflare Email Service → Email Sending. Account verification, invitations, and password recovery use a distinct `accounts@` address on the same domain by default; pass `--auth-email-from` to choose another address.
 
 The command creates a local project and prints a read-only infrastructure plan. It does not change Cloudflare unless `--deploy` is supplied or the generated project’s `npm run setup` command is run and explicitly confirmed.
 
@@ -68,7 +68,7 @@ npm run restore:plan -- .safest/backups/<backup-directory> --target-config repor
 npm run uninstall:plan
 ```
 
-The updater hashes Safest-owned project files and refuses to overwrite local modifications. It preserves `reports.config.json`, owner-only secrets, backups, the Cloudflare account selection, and the D1 database ID; creates a local rollback snapshot; takes a verified D1/R2 backup; installs and validates the release; then applies forward-only migrations and deploys. `update . --plan` is read-only.
+The updater hashes Safest-owned project files and refuses to overwrite local modifications. It preserves `reports.config.json`, owner-only secrets, backups, Cloudflare resource IDs, the Turnstile site key, customer webhook URLs, and the action allowlist; creates a local rollback snapshot; takes a verified D1/R2 backup; installs and validates the release; then applies forward-only migrations and deploys. `update . --plan` is read-only.
 
 Backups contain the D1 export and every object in the four private R2 buckets, with stable inventories and SHA-256 verification. They intentionally exclude pending Queue messages, live Workflow engine state, Worker secrets, external provider state, and ephemeral presence. Restore verification is local; restore planning requires a separate target installation and never mutates Cloudflare.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-safest-tools",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Create customer-owned abuse-reporting infrastructure on Cloudflare",
   "type": "module",
   "license": "Apache-2.0",

package/src/cli.mjs

@@ -29,7 +29,8 @@ Options:
   --origin origin        Allowed embedding/application origin; repeat as needed
   --owner-email email    Initial infrastructure owner bound to one-time setup
   --admin-email email    Deprecated alias for --owner-email
-  --email-from address   Address on an onboarded Email Sending domain (required)
+  --email-from address   Reporter-update sender on an onboarded Email Sending domain
+  --auth-email-from addr Account/invitation sender (default: accounts@same-domain)
   --yes                  Do not prompt for omitted optional values
   --skip-install         Create files without running npm install or setup:plan
   --deploy               Run setup after scaffolding (still requires exact confirmation)
@@ -54,7 +55,7 @@ export function parseArguments(argv) {
   const result = {
     command: commandName,
     directory: null, installationName: null, publicBaseUrl: null, allowedOrigins: [],
-    ownerEmail: null, emailFromAddress: null, yes: false, skipInstall: false,
+    ownerEmail: null, emailFromAddress: null, authEmailFromAddress: null, yes: false, skipInstall: false,
     deploy: false, dryRun: false, plan: false, help: false, version: false,
   };
   for (let index = commandName === "update" ? 1 : 0; index < argv.length; index += 1) {
@@ -69,7 +70,7 @@ export function parseArguments(argv) {
     else if (argument === "--plan") result.plan = true;
     else if (argument === "--help" || argument === "-h") result.help = true;
     else if (argument === "--version" || argument === "-v") result.version = true;
-    else if (["--name", "--public-url", "--origin", "--owner-email", "--admin-email", "--email-from"].includes(argument)) {
+    else if (["--name", "--public-url", "--origin", "--owner-email", "--admin-email", "--email-from", "--auth-email-from"].includes(argument)) {
       const value = valueAfter(argv, index, argument);
       index += 1;
       if (argument === "--name") result.installationName = value;
@@ -79,13 +80,14 @@ export function parseArguments(argv) {
         if (result.ownerEmail && result.ownerEmail !== value) throw new Error("provide only one infrastructure owner email");
         result.ownerEmail = value;
       }
-      else result.emailFromAddress = value;
+      else if (argument === "--email-from") result.emailFromAddress = value;
+      else result.authEmailFromAddress = value;
     } else throw new Error(`unknown option: ${argument}`);
   }
   if (result.deploy && result.skipInstall) throw new Error("--deploy cannot be used with --skip-install");
   if (result.command === "create" && result.plan) throw new Error("--plan is available only with the update command");
   if (result.command === "update" && (result.installationName || result.publicBaseUrl || result.allowedOrigins.length
-    || result.ownerEmail || result.emailFromAddress || result.skipInstall || result.deploy || result.dryRun)) {
+    || result.ownerEmail || result.emailFromAddress || result.authEmailFromAddress || result.skipInstall || result.deploy || result.dryRun)) {
     throw new Error("update accepts only a project directory, --plan, and --yes");
   }
   return result;
@@ -109,7 +111,7 @@ async function completeInteractive(options, input) {
   options.publicBaseUrl ||= await ask(input, "Public reports origin", "https://reports.example.com");
   if (!options.allowedOrigins.length) options.allowedOrigins.push(await ask(input, "Application origin allowed to embed the report form", "https://app.example.com"));
   options.ownerEmail ||= await ask(input, "Infrastructure owner email");
-  options.emailFromAddress ||= await ask(input, "Sender address on a Cloudflare Email Sending domain");
+  options.emailFromAddress ||= await ask(input, "Reporter-update sender on a Cloudflare Email Sending domain");
   return options;
 }
 

package/src/config.mjs

@@ -23,6 +23,20 @@ function optionalEmail(value, field) {
   return result;
 }
 
+function defaultAuthEmail(reporterEmail) {
+  const at = reporterEmail.lastIndexOf("@");
+  if (at < 1) return "";
+  const domain = reporterEmail.slice(at + 1);
+  return `${reporterEmail.slice(0, at).toLowerCase() === "accounts" ? "auth" : "accounts"}@${domain}`;
+}
+
+function emailAddresses(config) {
+  const reporter = optionalEmail(config.email?.fromAddress, "email.fromAddress");
+  const auth = optionalEmail(config.email?.authFromAddress, "email.authFromAddress") || defaultAuthEmail(reporter);
+  if (reporter && auth === reporter) throw new Error("authentication and reporter email senders must be different addresses");
+  return { reporter, auth };
+}
+
 function resource(base, suffix) {
   const prefix = base.slice(0, 63 - suffix.length - 1).replace(/-+$/u, "");
   return `${prefix}-${suffix}`;
@@ -37,6 +51,9 @@ export function buildConfiguration(options) {
   if (!ownerEmail) throw new Error("--owner-email is required");
   const emailFromAddress = optionalEmail(options.emailFromAddress, "email sender");
   if (!emailFromAddress) throw new Error("--email-from is required and its domain must be onboarded to Cloudflare Email Sending");
+  const authEmailFromAddress = optionalEmail(options.authEmailFromAddress, "authentication email sender")
+    || defaultAuthEmail(emailFromAddress);
+  if (authEmailFromAddress === emailFromAddress) throw new Error("--auth-email-from must differ from --email-from");
   const resources = {
     workerName: resource(installationId, "worker"),
     databaseName: resource(installationId, "db"),
@@ -61,7 +78,7 @@ export function buildConfiguration(options) {
     publicBaseUrl,
     allowedOrigins,
     owner: { email: ownerEmail },
-    email: { enabled: true, fromAddress: emailFromAddress },
+    email: { enabled: true, fromAddress: emailFromAddress, authFromAddress: authEmailFromAddress },
     auth: { password: true, providers: [] },
     retention: { reportsDays: 365, messagesDays: 180, appealWindowDays: 30 },
   };
@@ -70,6 +87,7 @@ export function buildConfiguration(options) {
 export function buildWranglerConfiguration(config) {
   const publicHostname = new URL(config.publicBaseUrl).hostname.toLowerCase();
   const usesWorkersDev = publicHostname.endsWith(".workers.dev");
+  const email = emailAddresses(config);
   const wrangler = {
     $schema: "node_modules/wrangler/config-schema.json",
     name: config.resources.workerName,
@@ -126,15 +144,18 @@ export function buildWranglerConfiguration(config) {
       ACTION_WEBHOOK_URL: "",
       NOTIFICATION_WEBHOOK_URL: "",
       OPERATOR_NOTIFICATION_WEBHOOK_URL: "",
-      AUTH_EMAIL_FROM: config.email.fromAddress,
-      EMAIL_FROM_ADDRESS: config.email.fromAddress,
-      EMAIL_SUBJECT_PREFIX: "Safest report update",
+      AUTH_EMAIL_FROM: email.auth,
+      REPORTER_EMAIL_FROM: email.reporter,
+      REPORTER_EMAIL_SUBJECT_PREFIX: "Safest report update",
     },
     triggers: { crons: ["*/5 * * * *"] },
   };
   if (!usesWorkersDev) {
     wrangler.routes = [{ pattern: publicHostname, custom_domain: true }];
   }
-  wrangler.send_email = [{ name: "EMAIL" }];
+  wrangler.send_email = [
+    { name: "AUTH_EMAIL", allowed_sender_addresses: [email.auth] },
+    { name: "REPORTER_EMAIL", allowed_sender_addresses: [email.reporter] },
+  ];
   return wrangler;
 }

package/src/update.mjs

@@ -7,6 +7,13 @@ import { buildWranglerConfiguration } from "./config.mjs";
 const MANIFEST_PATH = ".safest-managed.json";
 const MANIFEST_SCHEMA_VERSION = 1;
 const REBUILDABLE_PATHS = new Set(["public/console/auth-shell.js"]);
+const CUSTOMER_RUNTIME_VAR_KEYS = new Set([
+  "ALLOWED_ACTION_CODES",
+  "TURNSTILE_SITE_KEY",
+  "ACTION_WEBHOOK_URL",
+  "NOTIFICATION_WEBHOOK_URL",
+  "OPERATOR_NOTIFICATION_WEBHOOK_URL",
+]);
 
 function stableValue(value) {
   if (Array.isArray(value)) return value.map(stableValue);
@@ -58,6 +65,7 @@ function normalizedWranglerConfiguration(configuration) {
     delete database.database_id;
     delete database.preview_database_id;
   }
+  for (const key of CUSTOMER_RUNTIME_VAR_KEYS) delete normalized.vars?.[key];
   return normalized;
 }
 
@@ -65,6 +73,25 @@ function wranglerHash(configuration) {
   return sha256(stableJson(normalizedWranglerConfiguration(configuration)));
 }
 
+function legacyWranglerHash(configuration) {
+  const normalized = structuredClone(configuration);
+  delete normalized.account_id;
+  for (const database of normalized.d1_databases ?? []) {
+    delete database.database_id;
+    delete database.preview_database_id;
+  }
+  return sha256(stableJson(normalized));
+}
+
+function wranglerMatchesManifest(configuration, expectedHash) {
+  if (wranglerHash(configuration) === expectedHash || legacyWranglerHash(configuration) === expectedHash) return true;
+  const preUpdateDefaults = structuredClone(configuration);
+  for (const key of CUSTOMER_RUNTIME_VAR_KEYS) {
+    if (key in (preUpdateDefaults.vars ?? {})) preUpdateDefaults.vars[key] = "";
+  }
+  return legacyWranglerHash(preUpdateDefaults) === expectedHash;
+}
+
 function mergeWranglerRuntimeState(desired, current) {
   const result = structuredClone(desired);
   if (typeof current.account_id === "string" && current.account_id) result.account_id = current.account_id;
@@ -75,6 +102,9 @@ function mergeWranglerRuntimeState(desired, current) {
       if (typeof installed[field] === "string" && installed[field]) database[field] = installed[field];
     }
   }
+  for (const key of CUSTOMER_RUNTIME_VAR_KEYS) {
+    if (typeof current.vars?.[key] === "string") result.vars[key] = current.vars[key];
+  }
   return result;
 }
 
@@ -172,7 +202,7 @@ export async function planProjectUpdate({ directory, templateDirectory }) {
     if (currentHash !== null && currentHash !== targetHash) conflicts.push(path);
     added.push(path);
   }
-  if (wranglerHash(currentWrangler) !== manifest.wranglerHash) conflicts.push("wrangler.jsonc");
+  if (!wranglerMatchesManifest(currentWrangler, manifest.wranglerHash)) conflicts.push("wrangler.jsonc");
 
   const desiredWrangler = mergeWranglerRuntimeState(buildWranglerConfiguration(reportsConfiguration), currentWrangler);
   const deployed = (currentWrangler.d1_databases ?? []).some(({ database_id: id }) => typeof id === "string" && id.length > 0);
@@ -186,7 +216,7 @@ export async function planProjectUpdate({ directory, templateDirectory }) {
     ready: uniqueConflicts.length === 0,
     changes: { added: added.sort(), updated: updated.sort(), removed: removed.sort() },
     conflicts: uniqueConflicts,
-    preserves: ["reports.config.json", ".safest/secrets.env", ".safest/backups/", "Cloudflare account_id", "D1 database_id"],
+    preserves: ["reports.config.json", ".safest/secrets.env", ".safest/backups/", "Cloudflare account_id", "D1 database_id", "Turnstile site key", "customer webhook URLs and action allowlist"],
     manifest,
     targetFiles,
     desiredWrangler,

package/template/README.md

@@ -9,7 +9,7 @@ This project deploys one Worker, one D1 database, four private R2 buckets, a Dyn
 Before deployment:
 
 1. Review `reports.config.json` and `npm run setup:plan`.
-2. Under Cloudflare Email Service → Email Sending, onboard the configured sender domain. Invitations and password recovery to arbitrary recipients depend on domain onboarding.
+2. Under Cloudflare Email Service → Email Sending, onboard the configured sender domain. Reporter updates and account mail use separate sender addresses and sender-restricted bindings.
 3. Run `npm run setup`. The guided setup signs in through Wrangler and verifies Workers Paid from the account's Workers usage model before provisioning. Standard accounts need no separate billing token; only legacy or ambiguous models use the temporary Billing Read fallback. Setup then creates owner-only local secrets and walks through optional Google, GitHub, and Cloudflare OAuth credentials with exact callback URLs.
 4. Type the exact installation confirmation when setup requests it. After deployment, setup prints a 256-bit, single-use owner link that expires after 15 minutes and is never written to disk.
 5. Open the owner link, create the Safest owner account, then invite administrators and analysts from People. Nobody needs a Cloudflare account to sign in. Names and workspace roles are always displayed separately.
@@ -20,7 +20,7 @@ If the setup link expires, run `npm run owner:setup`. If the owner loses access
 
 Administrators build and preview questions in **Configuration → Intake forms**, set the logo, colours, fonts, and shape in **Settings → Branding**, then choose a private hosted page, signed-in product widget, or anonymous product widget in **Settings → Reporting channels**. Hosted pages and anonymous widgets need no API key. Signed-in widgets use one small customer-backend endpoint; verified reporter, target, and registered trusted facts stay server-side while the browser receives only a short-lived opaque token. Every public submission is verified with Turnstile inside a Resolve-owned isolated frame.
 
-Cloudflare Email Service and an `--email-from reports@example.com` address on an onboarded Email Sending domain are required for invitations, email verification, and password recovery. Participant notifications may still use a configured signed customer notification webhook.
+Cloudflare Email Service and an `--email-from reports@example.com` address on an onboarded Email Sending domain are required for reporter receipts, follow-ups, and outcomes. Invitations, email verification, and password recovery use a separate `accounts@` sender by default; `--auth-email-from` overrides it. A configured signed customer notification webhook remains the fallback for reference-only participants.
 
 ```bash
 npm run backup:plan
@@ -31,7 +31,7 @@ npx create-safest-tools@latest update . --plan
 npx create-safest-tools@latest update .
 ```
 
-The updater preserves customer configuration, secrets, backups, and Cloudflare resource IDs. It blocks on locally modified Safest-owned files, creates a local rollback snapshot, takes a verified D1/R2 backup, validates the new release, then applies forward-only migrations and deploys. `update . --plan` is read-only.
+The updater preserves customer configuration, secrets, backups, Cloudflare resource IDs, Turnstile configuration, customer webhook URLs, and the action allowlist. It blocks on locally modified Safest-owned files, creates a local rollback snapshot, takes a verified D1/R2 backup, validates the new release, then applies forward-only migrations and deploys. `update . --plan` is read-only.
 
 `npm run uninstall:plan` is deliberately read-only. It lists only the resources named by this installation and preserves D1 and all private R2 buckets by default.
 

package/template/console/reports/ReportDrawer.tsx

@@ -9,7 +9,7 @@ import {
   dispatchReporterMessage,
 } from "./events";
 import { getReportWorkspaceSnapshot, subscribeToReportWorkspace } from "./store";
-import type { ReportDetailRecord, TimelineEvent } from "./types";
+import type { ReportAnswer, ReportDetailRecord, TimelineEvent } from "./types";
 
 function Fact({ label, children }: { label: string; children: React.ReactNode }) {
   return <><dt>{label}</dt><dd>{children || "—"}</dd></>;
@@ -19,6 +19,40 @@ function EmptyLine({ children }: { children: React.ReactNode }) {
   return <p className="detail-empty">{children}</p>;
 }
 
+function answerOptionLabel(answer: ReportAnswer, value: string): string {
+  return answer.options?.find((option) => option.value === value)?.label || readable(value);
+}
+
+function AnswerValue({ answer }: { answer: ReportAnswer }) {
+  if (!answer.answered) return <span className="answer-empty">Not answered</span>;
+  if (typeof answer.value === "boolean") return <span>{answer.value ? "Yes" : "No"}</span>;
+  if (Array.isArray(answer.value)) {
+    const values = answer.value.map((value) => answerOptionLabel(answer, String(value)));
+    return <span>{values.length ? values.join(", ") : "None selected"}</span>;
+  }
+  if (answer.value === null || answer.value === undefined || answer.value === "") return <span className="answer-empty">Not answered</span>;
+  const value = String(answer.value);
+  if (answer.type === "select") return <span>{answerOptionLabel(answer, value)}</span>;
+  const url = answer.type === "url" ? safeCustomerUrl(value) : null;
+  return url
+    ? <a className="text-button" href={url} target="_blank" rel="noopener noreferrer" referrerPolicy="no-referrer">{value} ↗</a>
+    : <span className="answer-text">{value}</span>;
+}
+
+function deliveryLabel(state: string): string {
+  if (state === "suppressed") return "Not sent";
+  if (state === "queued" || state === "pending" || state === "sending" || state === "delivering") return "Queued";
+  return readable(state);
+}
+
+function deliveryExplanation(state: string): string {
+  if (state === "suppressed") return "No eligible participant delivery channel was available when this message was created.";
+  if (state === "queued" || state === "pending" || state === "sending" || state === "delivering") return "Waiting for the delivery worker.";
+  if (state === "delivered") return "Successfully handed to the configured delivery provider.";
+  if (state === "failed" || state === "rejected" || state === "bounced") return "Delivery needs attention in Operations.";
+  return "";
+}
+
 function timelineDetail(event: TimelineEvent): string {
   const details = event.details ?? {};
   const value = (key: string): string => typeof details[key] === "string" || typeof details[key] === "number" ? String(details[key]) : "";
@@ -38,7 +72,7 @@ function timelineMarker(eventType: string): string {
   return "•";
 }
 
-function DetailContent({ report, actorId, generatedAt, actionCodes, claimReports, messageReporters, decideReports, pendingAction, messageMutationVersion, error }: {
+function DetailContent({ report, actorId, generatedAt, actionCodes, claimReports, messageReporters, decideReports, pendingAction, messageMutationVersion, statusMessage, error }: {
   report: ReportDetailRecord;
   actorId: string;
   generatedAt: string;
@@ -48,9 +82,11 @@ function DetailContent({ report, actorId, generatedAt, actionCodes, claimReports
   decideReports: boolean;
   pendingAction: "claim" | "release" | "message" | "decision" | null;
   messageMutationVersion: number;
+  statusMessage: string;
   error: string;
 }) {
   const evidence = report.evidence ?? [];
+  const answers = report.answers ?? [];
   const messages = report.messages ?? [];
   const workflowRuns = report.workflowRuns ?? [];
   const timeline = report.timeline ?? [];
@@ -106,6 +142,14 @@ function DetailContent({ report, actorId, generatedAt, actionCodes, claimReports
   return (
     <>
       <div className="detail-grid">
+        <section className="report-submission"><h3>Reporter submission</h3><dl className="submission-meta">
+          <Fact label="Form">{report.formTitle || report.formVersionId || "Unknown form"}</Fact>
+          <Fact label="Channel">{readable(report.source || "unknown")}</Fact>
+          <Fact label="Submitted">{dateTime(report.submittedAt || report.receivedAt)}</Fact>
+          <Fact label="Language">{report.locale || "—"}</Fact>
+        </dl><div className="answer-list">
+          {answers.length ? answers.map((answer) => <article className="answer-record" key={answer.fieldKey}><div><strong>{answer.label || readable(answer.fieldKey)}</strong>{answer.required ? <small>Required question</small> : null}</div><AnswerValue answer={answer} /></article>) : <EmptyLine>This form did not contain additional questions.</EmptyLine>}
+        </div></section>
         <section><h3>Allegation and target</h3><dl>
           <Fact label="Allegation">{readable(report.reasonCode)}</Fact>
           <Fact label="Target type">{readable(report.targetType)}</Fact>
@@ -125,22 +169,23 @@ function DetailContent({ report, actorId, generatedAt, actionCodes, claimReports
 
       {workflowRuns.length || timeline.length ? <section><h3>Workflow &amp; case timeline</h3><div className="report-run-list">{workflowRuns.map((run) => <article className="report-run-record" key={run.id}><div><strong>{run.workflowName || run.workflowKey || `Workflow ${String(run.workflowVersionId || run.id).slice(0, 12)}`}</strong><small>{readable(run.runKind || "primary")} · {readable(run.authorityMode || "assist")} · immutable version {run.workflowVersion || String(run.workflowVersionId || "").slice(0, 12)}</small></div><span className={`badge${["failed", "repair_required"].includes(run.state) ? " urgent" : ""}`}>{readable(run.state)}</span></article>)}</div><div className="report-timeline">{timeline.map((item, index) => <article className="timeline-event" key={item.id ?? `${item.eventType}-${item.createdAt}-${index}`}><span className={`timeline-marker ${item.eventType || "event"}`}>{timelineMarker(item.eventType)}</span><div><strong>{readable(item.eventType || "activity")}</strong><span>{timelineDetail(item)}</span><small>{relativeTime(item.createdAt)} · {readable(item.actorType || "system")}</small></div></article>)}</div></section> : null}
 
-      <section><h3>Case messages</h3><div className="message-list">{messages.length ? messages.map((item, index) => <article className={`case-message ${item.direction}`} key={item.id ?? `${item.createdAt}-${index}`}><div>{item.body}</div><small>{readable(item.senderType)} · {dateTime(item.createdAt)} · {readable(item.deliveryState)}</small></article>) : <EmptyLine>No case messages yet.</EmptyLine>}</div></section>
+      <section><h3>Case messages</h3><div className="message-list">{messages.length ? messages.map((item, index) => <article className={`case-message ${item.direction}`} key={item.id ?? `${item.createdAt}-${index}`}><div>{item.body}</div><small>{readable(item.senderType)} · {dateTime(item.createdAt)} · {deliveryLabel(item.deliveryState)}{deliveryExplanation(item.deliveryState) ? ` — ${deliveryExplanation(item.deliveryState)}` : ""}</small></article>) : <EmptyLine>No case messages yet.</EmptyLine>}</div></section>
 
       {findings.length ? <section><h3>Component findings</h3><div className="finding-result-list">{findings.map((finding, index) => <article key={finding.id ?? `${finding.findingType}-${index}`}><div><strong>{finding.findingType}</strong><small>{finding.summary}{finding.componentVersionId ? ` · component ${finding.componentVersionId}` : ""}{finding.expiresAt ? ` · expires ${dateTime(finding.expiresAt)}` : ""}</small>{finding.data ? <pre>{JSON.stringify(finding.data, null, 2)}</pre> : null}</div><span className={`badge${finding.freshness !== "available" ? " urgent" : ""}`}>{readable(finding.freshness || finding.status)}</span></article>)}</div></section> : null}
 
       {decisions.length ? <section><h3>Decisions &amp; rationale</h3><div className="decision-record-list">{decisions.map((decision, index) => <article className="decision-record" key={decision.id ?? `${decision.createdAt}-${index}`}><div><strong>{readable(decision.decisionCode)}</strong><span className="badge">{decision.policyCode || "Policy decision"}</span></div><p>{decision.rationale || "No rationale recorded."}</p><small>{readable(decision.makerType)} · {dateTime(decision.createdAt)} · {(decision.evidenceReferences || []).length} evidence reference(s)</small></article>)}</div></section> : null}
 
-      {deliveries.length ? <section><h3>Decision and delivery</h3><div className="delivery-list">{deliveries.map((delivery) => <article key={delivery.id}><div><strong>{delivery.title}</strong><small>{delivery.detail}</small></div><span className={`badge${["failed", "rejected"].includes(delivery.state) ? " urgent" : ""}`}>{readable(delivery.state)}</span></article>)}</div></section> : null}
+      {deliveries.length ? <section><h3>Decision and delivery</h3><div className="delivery-list">{deliveries.map((delivery) => <article key={delivery.id}><div><strong>{delivery.title}</strong><small>{delivery.detail}{deliveryExplanation(delivery.state) ? ` · ${deliveryExplanation(delivery.state)}` : ""}</small></div><span className={`badge${["failed", "rejected", "bounced", "suppressed"].includes(delivery.state) ? " urgent" : ""}`}>{deliveryLabel(delivery.state)}</span></article>)}</div></section> : null}
 
       {aiRuns.length ? <section><h3>Bounded AI record</h3><div className="ai-run-list">{aiRuns.map((run, index) => <article key={run.id ?? `${run.model}-${index}`}><div><strong>{readable(run.mode)} · {readable(run.status)}</strong><small>{run.model} · {run.promptVersion} · {run.configVersionId}</small></div><p>{run.summary || readable(run.errorCode || "No validated result")}</p><small>{readable(run.outcome || "no outcome")} · {run.policyCode || "no policy"} · {run.estimatedCostMicrousd || 0} µUSD{run.uncertain ? " · escalated for uncertainty" : ""}</small></article>)}</div></section> : null}
 
       <div className="claim-bar"><p>{activeClaim && report.claim ? <><AnalystAvatar analyst={report.claim.analyst ?? { displayName: "Another reviewer" }} size="small" />{mine ? "You hold" : `${report.claim.analyst?.displayName || "Another reviewer"} holds`} this report until {new Date(report.claim.expiresAt).toLocaleTimeString()}.</> : "This report must be claimed before a reviewer changes it."}</p><div>{mine ? <button className="secondary" type="button" disabled={changingClaim} onClick={dispatchReleaseReport}>{pendingAction === "release" ? "Releasing…" : "Release"}</button> : null}{claimable && !activeClaim ? <button className="primary" type="button" disabled={changingClaim} onClick={dispatchClaimReport}>{pendingAction === "claim" ? "Claiming…" : "Claim report"}</button> : null}</div></div>
 
       <div className="detail-actions">
-        <form onSubmit={sendMessage}><h3>Ask the reporter</h3><label>Message<textarea maxLength={4000} required value={message} onChange={(event) => setMessage(event.currentTarget.value)} disabled={!canMessage || pendingAction === "message"} /></label><label className="checkbox"><input type="checkbox" checked={awaitReporter} onChange={(event) => setAwaitReporter(event.currentTarget.checked)} disabled={!canMessage || pendingAction === "message"} />Move to awaiting reporter</label><button className="secondary" type="submit" disabled={!canMessage || pendingAction === "message"}>{pendingAction === "message" ? "Sending…" : "Send participant update"}</button></form>
+        <form onSubmit={sendMessage}><h3>Ask the reporter</h3><p className="form-help">The update is emailed when the reporter supplied an address. Otherwise, Resolve uses the configured signed customer notification channel.</p><label>Message<textarea maxLength={4000} required value={message} onChange={(event) => setMessage(event.currentTarget.value)} disabled={!canMessage || pendingAction === "message"} /></label><label className="checkbox"><input type="checkbox" checked={awaitReporter} onChange={(event) => setAwaitReporter(event.currentTarget.checked)} disabled={!canMessage || pendingAction === "message"} />Move to awaiting reporter</label><button className="secondary" type="submit" disabled={!canMessage || pendingAction === "message"}>{pendingAction === "message" ? "Queueing…" : "Send participant update"}</button></form>
         <form onSubmit={recordDecision}><h3>Record a human decision</h3><label>Decision code<input value={decisionCode} onChange={(event) => setDecisionCode(event.currentTarget.value)} disabled={!canDecide || pendingAction === "decision"} required /></label><label>Policy code<select value={policyCode} onChange={(event) => setPolicyCode(event.currentTarget.value)} disabled={!canDecide || pendingAction === "decision"} required>{rules.map((rule) => <option value={rule.code} key={rule.code}>{rule.title ? `${rule.code} · ${rule.title}` : rule.code}</option>)}</select></label><label>Internal rationale<textarea maxLength={8000} value={rationale} onChange={(event) => setRationale(event.currentTarget.value)} disabled={!canDecide || pendingAction === "decision"} required /></label><label>Reporter outcome<textarea maxLength={4000} value={reporterNotice} onChange={(event) => setReporterNotice(event.currentTarget.value)} disabled={!canDecide || pendingAction === "decision"} required /></label><label>Affected-user notice <small>Optional; sent through a separate audience channel.</small><textarea maxLength={4000} value={affectedNotice} onChange={(event) => setAffectedNotice(event.currentTarget.value)} disabled={!canDecide || pendingAction === "decision"} /></label>{actionCodes.length ? <label>Application action <small>Optional. Only deployment-allowlisted actions are shown.</small><select value={actionCode} onChange={(event) => setActionCode(event.currentTarget.value)} disabled={!canDecide || pendingAction === "decision"}><option value="">No application action</option>{actionCodes.map((code) => <option value={code} key={code}>{readable(code)}</option>)}</select></label> : null}<button className="primary" type="submit" disabled={!canDecide || pendingAction === "decision"}>{pendingAction === "decision" ? "Recording…" : "Complete human review"}</button></form>
       </div>
+      <p className="mutation-status" role="status">{statusMessage}</p>
       <p className="error" role="alert">{error}</p>
     </>
   );
@@ -153,7 +198,7 @@ export function ReportDrawer() {
   return (
     <dialog className="detail-dialog report-drawer" open={open} aria-labelledby="report-detail-title" onCancel={(event) => { event.preventDefault(); dispatchCloseReport(); }} data-react-slice="report-drawer">
       <div className="detail-head"><div><h2 id="report-detail-title">{detail.report?.reference || "Report"}</h2><p>{detail.report ? `${readable(detail.report.state)} · ${readable(detail.report.queueId || "unassigned")}` : "Loading report…"}</p></div><button className="icon-button" type="button" aria-label="Close report detail" onClick={dispatchCloseReport}>×</button></div>
-      <div className="report-detail-content">{detail.loading && !detail.report ? <div className="skeleton-block" role="status" aria-label="Loading report detail" /> : detail.report ? <DetailContent report={detail.report} actorId={snapshot.actorId} generatedAt={snapshot.generatedAt} actionCodes={snapshot.actionCodes} claimReports={snapshot.permissions.claimReports} messageReporters={snapshot.permissions.messageReporters} decideReports={snapshot.permissions.decideReports} pendingAction={detail.pendingAction} messageMutationVersion={detail.messageMutationVersion} error={detail.error} /> : detail.error ? <p className="error surface-error" role="alert">{detail.error}</p> : null}</div>
+      <div className="report-detail-content">{detail.loading && !detail.report ? <div className="skeleton-block" role="status" aria-label="Loading report detail" /> : detail.report ? <DetailContent report={detail.report} actorId={snapshot.actorId} generatedAt={snapshot.generatedAt} actionCodes={snapshot.actionCodes} claimReports={snapshot.permissions.claimReports} messageReporters={snapshot.permissions.messageReporters} decideReports={snapshot.permissions.decideReports} pendingAction={detail.pendingAction} messageMutationVersion={detail.messageMutationVersion} statusMessage={detail.statusMessage} error={detail.error} /> : detail.error ? <p className="error surface-error" role="alert">{detail.error}</p> : null}</div>
     </dialog>
   );
 }

package/template/console/reports/controller.ts

@@ -62,7 +62,7 @@ const initialSnapshot = (): ReportWorkspaceSnapshot => ({
   presence: [],
   actionCodes: [],
   permissions: { claimReports: false, messageReporters: false, decideReports: false, readRuns: false },
-  detail: { reportId: null, loading: false, error: "", pendingAction: null, messageMutationVersion: 0, report: null },
+  detail: { reportId: null, loading: false, error: "", statusMessage: "", pendingAction: null, messageMutationVersion: 0, report: null },
 });
 
 let actorId = "";
@@ -223,6 +223,7 @@ async function openReport(reportId: string): Promise<void> {
       reportId,
       loading: true,
       error: "",
+      statusMessage: snapshot.detail.reportId === reportId ? snapshot.detail.statusMessage : "",
       report: snapshot.detail.report?.id === reportId ? snapshot.detail.report : null,
     },
   });
@@ -262,7 +263,7 @@ function closeReport(): void {
   detailRequestVersion += 1;
   const messageMutationVersion = getReportWorkspaceSnapshot().detail.messageMutationVersion;
   document.body.classList.remove("report-open");
-  publish({ detail: { reportId: null, loading: false, error: "", pendingAction: null, messageMutationVersion, report: null } });
+  publish({ detail: { reportId: null, loading: false, error: "", statusMessage: "", pendingAction: null, messageMutationVersion, report: null } });
   sendPresenceActivity();
 }
 
@@ -301,15 +302,20 @@ async function sendMessage(input: ReporterMessageInput): Promise<void> {
   const reportId = snapshot.detail.report?.id;
   if (!reportId || !snapshot.permissions.messageReporters || snapshot.detail.pendingAction) return;
   const idempotencyKey = crypto.randomUUID();
-  publish({ detail: { ...snapshot.detail, error: "", pendingAction: "message" } });
+  publish({ detail: { ...snapshot.detail, error: "", statusMessage: "", pendingAction: "message" } });
   try {
-    await requestJson(`/v1/admin/reports/${encodeURIComponent(reportId)}/messages`, {
+    const response = await requestJson<{ delivery_state?: string; delivery_channel?: string | null }>(`/v1/admin/reports/${encodeURIComponent(reportId)}/messages`, {
       method: "POST",
       headers: { "content-type": "application/json", "idempotency-key": idempotencyKey },
       body: JSON.stringify({ idempotency_key: idempotencyKey, body: input.body, await_reporter: input.awaitReporter }),
     });
     const version = getReportWorkspaceSnapshot().detail.messageMutationVersion + 1;
-    publish({ detail: { ...getReportWorkspaceSnapshot().detail, messageMutationVersion: version } });
+    const statusMessage = response.delivery_state === "queued"
+      ? response.delivery_channel === "email"
+        ? "Participant update queued for email delivery."
+        : "Participant update queued for the configured customer notification channel."
+      : "The update was saved but not sent because this report has no available participant delivery channel.";
+    publish({ detail: { ...getReportWorkspaceSnapshot().detail, messageMutationVersion: version, statusMessage } });
     await Promise.all([openReport(reportId), loadReports()]);
   } catch (cause) {
     publish({ detail: { ...getReportWorkspaceSnapshot().detail, error: errorMessage(cause, "The message could not be created.") } });

package/template/console/reports/store.ts

@@ -15,7 +15,7 @@ let snapshot: ReportWorkspaceSnapshot = {
   presence: [],
   actionCodes: [],
   permissions: { claimReports: false, messageReporters: false, decideReports: false, readRuns: false },
-  detail: { reportId: null, loading: false, error: "", pendingAction: null, messageMutationVersion: 0, report: null },
+  detail: { reportId: null, loading: false, error: "", statusMessage: "", pendingAction: null, messageMutationVersion: 0, report: null },
 };
 
 window.addEventListener(reportEvents.state, (event) => {

package/template/console/reports/types.ts

@@ -151,12 +151,33 @@ export interface ReportClaim {
   analyst?: AnalystIdentityData;
 }
 
+export interface ReportAnswerOption {
+  value: string;
+  label: string;
+}
+
+export interface ReportAnswer {
+  fieldKey: string;
+  label: string;
+  type: string;
+  required: boolean;
+  answered: boolean;
+  value: unknown;
+  options?: ReportAnswerOption[];
+}
+
 export interface ReportDetailRecord {
   id: string;
   reference: string;
   state: string;
   queueId?: string;
   reasonCode: string;
+  source?: string;
+  locale?: string;
+  submittedAt?: string;
+  formVersionId?: string;
+  formTitle?: string;
+  consentNotice?: string;
   targetType: string;
   targetReference: string;
   customerUrl?: string;
@@ -168,6 +189,7 @@ export interface ReportDetailRecord {
   reviewerInstructions?: string;
   receivedAt: string;
   policyRules?: PolicyRule[];
+  answers?: ReportAnswer[];
   evidence?: EvidenceReference[];
   messages?: CaseMessage[];
   workflowRuns?: WorkflowRunRecord[];
@@ -189,6 +211,7 @@ export interface ReportDetailSnapshot {
   error: string;
   pendingAction: ReportPendingAction;
   messageMutationVersion: number;
+  statusMessage: string;
   report: ReportDetailRecord | null;
 }
 

package/template/package.json

@@ -1,7 +1,7 @@
 {
   "name": "safest-resolve-installation",
-  "version": "0.4.0",
-  "safestToolsVersion": "0.4.0-resolve",
+  "version": "0.4.1",
+  "safestToolsVersion": "0.4.1-resolve",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",